hello, i have an older envirionment that predates journald, where rsyslog-relp is used to forward all rsyslog messages to a specific host and then ommysql puts the messages into a database. i then have phplogcon attach to the database and provide a web interface to the logs. this is a great setup for me and has been working for some time.
i am now in the process of updating many of my systems and journald is changing things. it looks like i can use omjournal to send the journal messages to a central device, but i am not sure if the reliable part of relp is built into omjournal. i would assume not. can omjournal and omrelp be used together to provide reliable transmission of journald messages to a central device? i also find that imuxsocks can be used. what are other people doing? once i get messages to the central device, how does one get journald messages into mysql for phplogcon to be used? currently, i have the below config, but it does not insert records into the database. clearly, i am missing something. could you point me in the correct direction? module(load="imuxsock") module(load="imjournal") module(load="imklog") #module(load="immark") # Provides UDP syslog reception module(load="imudp") input(type="imudp" port="514") # Provides TCP syslog reception module(load="imtcp") input(type="imtcp" port="514") # Provides RELP reception module(load="imrelp") input(type="imrelp" port="20514") # Load MySQL support module(load="ommysql") # MASSIVE INSERT RATE FOR DB / SCALED DB LOGGING $WorkDirectory /var/spool/rsyslog # default location for work files $ActionQueueType LinkedList # use asynchronous processing $ActionQueueFileName dbq # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # File to store the position in the journal $IMJournalStateFile imjournal.state #### RULES #### if ( $inputname == 'imudp' or $inputname == 'imtcp' or $inputname == 'imrelp' ) then action(type="ommysql" server="server1.bpk2.com" serverport="3306" db="Syslog" uid="syslog" pwd="syslog") & stop _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
